docs(csec): add cybersecurity toolkit catalog#161
Conversation
Introduces docs/csec/ with two long-form references:
* toolkit.md describes every cybersecurity-relevant package this repo
ships across recon, web testing, credential attacks, RE, forensics,
and dual-use utilities.
* additional-tools-reference.md catalogs pentesting tools available via
nix run/nix shell that complement the active toolkit, grouped by
domain (AD, recon, web, credentials, wireless, RE, forensics, stego,
SAST, cloud, pivoting).
Adds modules/csec/additional-tools-runtime-status.md to track which
nixpkgs entries currently build cleanly so the additional-tools list
stays honest. Wires both toolkit pages into the docs/index.md table of
contents under a new Cybersecurity section.
Allowlist `gost` (GO Simple Tunnel, ginuerzh/gost) in .typos.toml so the
typos hook does not flag the genuine tool name as a misspelling of "ghost".
Bad3r
added
type(docs)
|
Claude finished @Bad3r's task in 4m 53s —— View job Review summaryTwo well-organized catalogs that fill a real documentation gap, plus one supporting The blocking concerns are factual — Blocking issues1. The doc says "When I grepped exhaustively (
This entire section describes infrastructure that is not implemented. Either land the module first, gate the section behind a "Planned" header, or remove it. As-is it will mislead operators into running a 2. Seven tools listed in The doc opens with "Source of truth: each host's
These belong in 3. But
The Repo, Docs, and Stat fields should reflect what the host actually installs (LibreSSL, maintained), not Hobbit's 1996 nc110 — those are different projects and different maintenance stories. Same entry classification flows into the catalog's "deprecated tools" tally. Non-blocking issues4. 5. Awkward relative links — [`docs/csec/toolkit.md`](../../docs/csec/toolkit.md)
[`docs/guides/apps-module-style-guide.md`](../../docs/guides/apps-module-style-guide.md)Both files live in 6. Several "Maintained (latest release 2026-05-XX)" dates exactly match the 2026-05-04 verification stamp — e.g. 7. 8. Things done well
Validation
Checklist
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 39788f5974
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request establishes a comprehensive cybersecurity documentation framework, adding a primary toolkit catalog and an extensive reference for additional pentesting tools available via Nix. It also includes a runtime status report based on smoke tests of the documented tools. The reviewer feedback identifies several inaccuracies in the tool invocation examples, specifically regarding mismatched binary names, outdated subcommands, and missing environment flags for unfree packages.
Move the additional-tools smoke-test companion out of modules/, which is reserved for Nix modules and auto-discovery, and link it from the reference catalog so the report is reachable.
Remove the csec.wordlists.* description from toolkit.md; that option namespace, the wordlists meta-package consumer, and the /usr/share/wordlists symlink wiring are not present in this repository, so the section misled readers into setting an option that does not evaluate. Replace it with a short pointer to the canonical share/ trees that the listed packages already expose. Move dnsenum, ffuf, wfuzz, wpscan, xnlinkfinder, nuclei, and nuclei-templates to additional-tools-reference.md. None of them have a matching modules/apps/<name>.nix module or an entry in either host's apps-enable.nix, so per the toolkit doc's own "Source of truth" rule they do not belong in toolkit.md. Each entry keeps its description and upstream metadata and switches to a `nix run nixpkgs#...` invocation. The wpscan entry adds the `NIXPKGS_ALLOW_UNFREE=1 --impure` prefix the unfreeRedistributable license requires.
modules/apps/netcat.nix wraps `pkgs.netcat`, which nixpkgs aliases to LibreSSL's portable netcat (`-DENABLE_NC=ON`, `bin/nc` extracted from libressl). The previous Repo, Docs, and Stat fields described Hobbit's nc110 (1996, abandoned), which is a different upstream and would mislead anyone auditing the catalog. Point Repo at libressl/portable, Docs at the OpenBSD nc(1) man page, note the LibreSSL provenance, and flip the Stat to Maintained.
Introduce a Core utility Stat tier for foundational tooling whose release cadence does not match the existing buckets. Reclassify bzip2 1.0.8 and GNU tar 1.35 under it instead of "Maintenance mode" so the catalog does not imply an upstream cadence the projects never had. Add a successor pointer to the Deprecated zip and unzip entries so operators copying the catalog see bsdtar/bsdunzip and p7zip as the forward path; matches the precedent set by dirbuster -> gobuster and iotop -> iotop-c elsewhere in this file.
The `../../docs/csec/toolkit.md` and `../../docs/guides/...` paths worked but rebased through the repo root for no reason. Use `toolkit.md` (same directory) and `../guides/apps-module-style-guide.md` (one level up) so the links read naturally and survive future restructuring of the docs root.
Each entry below now reflects the actual nixpkgs derivation rather than the upstream marketing CLI, so a reader copy-pasting the representative invocation gets a working command on the first try. The runtime-status report retains the historical failure receipts. - impacket: drop the non-existent `impacket-secretsdump` alias and invoke `secretsdump.py` directly. Note the `.py` suffix convention in the description. - kerbrute: nixpkgs#kerbrute packages TarlogicSecurity's Python tool, not ropnop's Go binary. Repoint the Repo/Docs URLs, switch the run command to Tarlogic's `-domain/-users/-passwords` form, and call out ropnop's separate upstream as not in nixpkgs. - gowitness: switch `single -u` to `scan -u` (CLI rename in v3). - pwntools: `meta.mainProgram` is unset upstream; use `nix shell ... -c pwn` instead of `nix run`. - volatility3: prefix `NIXPKGS_ALLOW_UNFREE=1 --impure` and call `vol` (the actual binary; `volatility3` does not exist). - hayabusa: nixpkgs#hayabusa is `koutoftimer`'s IPC daemon, not the Yamato Security EVTX scanner. Mark as "Must create a custom nixpkg" consistent with falco / velociraptor / pwndbg. - scoutsuite: PyPI ships `scout`; use `uvx --from scoutsuite scout`. - ligolo-ng: ships `ligolo-proxy` and `ligolo-agent`; invoke through `nix shell -c ligolo-proxy`. - frp: ships `frpc` and `frps` with no default app; invoke through `nix shell -c frpc`.
Review feedback addressedSix atomic commits land on this branch. Each maps to one logical concern from the review.
AcceptedBlocking #1 — Blocking #2 — seven tools not shipped. Confirmed against Blocking #3 — netcat is LibreSSL, not Hobbit nc110. Non-blocking #4 — runtime-status doc location. Moved to Non-blocking #5 — awkward relative links. Switched to the sibling form ( Non-blocking #7 — zip/unzip successor pointers. Added Non-blocking #8 — bzip2/tar framing. Introduced a fourth Stat tier, Core utility, in the catalog header and reclassified Inline comments —
Verbose inline Acknowledged but not changedNon-blocking #6 — clustered "2026-05-XX" dates. The dates were transcribed from upstream tags and release pages by hand on 2026-05-04, and the clustering is real (kubescape v4.0.6, katana v1.6.0, syft v1.44.0, grype v0.112.0, prowler v5.25.1, semgrep v1.161.0, nuclei v3.8.0 all tagged inside the same week). I have not re-fetched them in this loop, so the verification timestamp is the original one. If a future smoke-test discovers drift, the runtime-status report is the right place to catch it. Threads resolvedAll 11 inline review threads ( Test plan
|
|
Claude finished @Bad3r's task in 3m 4s —— View job Follow-up reviewAll seven items from the prior review are landed correctly across the six follow-up commits, plus the inline Verification matrix
Inline
|
| Tool | New run..: |
Note |
|---|---|---|
impacket |
nix shell nixpkgs#python3Packages.impacket -c secretsdump.py -- ... |
Drops the non-existent impacket-secretsdump alias. |
kerbrute |
nix run nixpkgs#kerbrute -- -domain $domain -users users.txt -passwords passwords.txt |
Repo/Docs repointed at TarlogicSecurity/kerbrute; ropnop is called out as a separate, unpackaged upstream. |
gowitness |
nix run nixpkgs#gowitness -- scan -u $url |
v3 rename applied. |
pwntools |
nix shell nixpkgs#pwntools -c pwn -- shellcraft amd64.linux.sh |
Sidesteps missing meta.mainProgram. |
volatility3 |
NIXPKGS_ALLOW_UNFREE=1 nix shell --impure nixpkgs#volatility3 -c vol -- ... |
Unfree prefix + vol binary. |
hayabusa |
Must create a custom nixpkg |
Aligned with the falco/velociraptor/pwndbg precedent. |
scoutsuite |
uvx --from scoutsuite scout $provider |
Fixes the entry-point name. |
ligolo-ng |
nix shell nixpkgs#ligolo-ng -c ligolo-proxy -- -selfcert -laddr 0.0.0.0:11601 |
Uses real ligolo-proxy binary. |
frp |
nix shell nixpkgs#frp -c frpc -- -c frpc.toml |
Uses real frpc binary. |
⚠️ Failed to run notes were stripped from these nine entries (verified via awk/grep -c '⚠️' per entry → 0). The runtime-status report retains the historical receipts (8 mentions of impacket, 4 of pwntools and scoutsuite, etc.) so the failure provenance is not lost.
Residual non-blocking observations
These are not blockers and the PR author already explicitly chose not to re-fetch dates per NB #6 — surfacing for awareness only.
A. wfuzz Stat field — likely transcription artifact (NB #6, deferred) — additional-tools-reference.md:341.
The entry currently reads Stat.: Maintained (latest release 2026-01-21). xmendez/wfuzz upstream stopped tagging at v3.1.0 in 2020; the maintainer publicly archived the project. If a re-verification pass is ever scheduled, wfuzz is the strongest candidate to flip to Deprecated alongside the existing classifications. Not blocking — the prior review already accepted that the dates were transcribed by hand on 2026-05-04 and would be reconciled on the next smoke-test run.
B. additional-tools-runtime-status.md not linked from docs/index.md — docs/index.md:83-88.
The Cybersecurity section indexes toolkit.md and additional-tools-reference.md but not the runtime-status report. The reference doc links to it inline (line 5), so it's reachable; just noting that an operator skimming docs/index.md won't see the smoke-test record from the top level. Adding a third bullet — or leaving the runtime-status report as a child of the reference doc — both work; current setup is consistent with treating it as an appendix.
Things done well in this round
- The kerbrute correction goes beyond the inline comment: the
Repo/DocsURLs were repointed atTarlogicSecurity/kerbrute(the upstream that nixpkgs actually packages) and ropnop's separate Go tool is called out as not-packaged. That avoids a second-order confusion the reviewer didn't even raise. wpscancorrectly carries theNIXPKGS_ALLOW_UNFREE=1 ... --impureprefix in its new home — that's not one the inline comments asked for, but it's the right call given theunfreeRedistributablemarker.- The new Core utility Stat tier (
toolkit.md:14) is a tidy way to handle the bzip2/tar framing without inventing a release cadence those projects don't have. - Six atomic commits, one logical concern each. Easy to review, easy to revert any single change in isolation.
Checklist
- Verify Blocking feat: add nixos app helpers #1 —
csec.wordlists.*section removed - Verify Blocking docs: normalize filenames to kebab case #2 — 7 unshipped tools moved to additional-tools-reference.md
- Verify Blocking feat(claude-code): manage claude shell config declaratively #3 — netcat repointed at LibreSSL
- Verify NB feat: Add Claude Code GitHub Workflow #4 — runtime-status doc relocated under
docs/csec/ - Verify NB feat(cf-auto-docs): NixOS module documentation API via CloudFlare #5 — sibling-relative links in
docs/csec/ - Verify NB feat(claude-code): manage claude shell config declaratively #7/feat: add Espanso text expander #8 — archive/core-utility classifications
- Verify inline
run..:corrections (impacket, kerbrute, gowitness, pwntools, volatility3, hayabusa, scoutsuite, ligolo-ng, frp) - Spot-check unchanged content for residual claims about non-existent infra
Validation
- Did not run
nix flake check— change is documentation-only plus a.typos.tomlallowlist entry; perCLAUDE.mdvalue-level non-Nix changes don't require it.
·docs/csec-toolkit
Top-level operators skimming docs/index.md only saw toolkit.md and the additional-tools reference; the smoke-test companion was reachable only by following the inline link inside the reference. List it as a peer entry so the cross-reference is discoverable from the docs root.
Round 2 follow-upTwo residual observations from Observation B: runtime-status missing from
|
|
Claude finished @Bad3r's task in 2m 16s —— View job Round 3 review
Verification
Re-confirmation of round 1 / round 2 fixes (no regressions)
Catalog totals
Final assessmentThe The No further blocking or non-blocking issues identified. All review threads from rounds 1, 2, and 3 are resolvable from this branch. Validation
Checklist
|
1 participant
Summary
docs/csec/:toolkit.mddescribes every cybersecurity-relevant package this repo ships across recon, web testing, credential attacks, RE, forensics, and dual-use utilities.additional-tools-reference.mdcatalogs pentesting tools available vianix run/nix shellthat complement the active toolkit, grouped by domain (AD, recon, web, credentials, wireless, RE, forensics, stego, SAST, cloud, pivoting).modules/csec/additional-tools-runtime-status.mdto track which nixpkgs entries currently build cleanly so the additional-tools list stays honest.docs/index.mdunder a new Cybersecurity section.gost(GO Simple Tunnel, ginuerzh/gost) in.typos.tomlso the typos hook does not flag the genuine tool name as a misspelling of "ghost".Test plan
nix develop -c pre-commit run --all-files --hook-stage manual— typos and treefmt pass.docs/csec/toolkit.mdanddocs/csec/additional-tools-reference.mdfor accuracy.